<html>
<head><meta charset="utf-8"><title>Is this possible to fix without API break? · t-lang/wg-unsafe-code-guidelines · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/index.html">t-lang/wg-unsafe-code-guidelines</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is.20this.20possible.20to.20fix.20without.20API.20break.3F.html">Is this possible to fix without API break?</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="169239411"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is%20this%20possible%20to%20fix%20without%20API%20break%3F/near/169239411" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is.20this.20possible.20to.20fix.20without.20API.20break.3F.html#169239411">(Jun 28 2019 at 16:20)</a>:</h4>
<p>This code is unsound: <a href="https://github.com/sile/libflate/blob/cbf1289f967c8fdff3b8ff3e06256ff7b62cc914/src/gzip.rs#L1122" target="_blank" title="https://github.com/sile/libflate/blob/cbf1289f967c8fdff3b8ff3e06256ff7b62cc914/src/gzip.rs#L1122">https://github.com/sile/libflate/blob/cbf1289f967c8fdff3b8ff3e06256ff7b62cc914/src/gzip.rs#L1122</a><br>
If a panic occurs before <code>mem::forget()</code> is reached, <code>drop()</code>is called on uninitialized data of arbitrary type. I've been trying to come up with a way to fix this, but to no avail. Is this fixable without breaking the API? And how does one rewrite something like that in safe Rust?</p>



<a name="169240616"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is%20this%20possible%20to%20fix%20without%20API%20break%3F/near/169240616" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is.20this.20possible.20to.20fix.20without.20API.20break.3F.html#169240616">(Jun 28 2019 at 16:35)</a>:</h4>
<p><span class="user-mention" data-user-id="127617">@Shnatsel</span> from a superficial glance, looks like a case for this crate? <a href="https://crates.io/crates/take_mut" target="_blank" title="https://crates.io/crates/take_mut">https://crates.io/crates/take_mut</a></p>



<a name="169240669"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is%20this%20possible%20to%20fix%20without%20API%20break%3F/near/169240669" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is.20this.20possible.20to.20fix.20without.20API.20break.3F.html#169240669">(Jun 28 2019 at 16:36)</a>:</h4>
<p>I've also seen proposals to add such functionality to libstd</p>



<a name="169240680"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is%20this%20possible%20to%20fix%20without%20API%20break%3F/near/169240680" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is.20this.20possible.20to.20fix.20without.20API.20break.3F.html#169240680">(Jun 28 2019 at 16:36)</a>:</h4>
<p>Take <code>&amp;mut</code>? Is that even legal?</p>



<a name="169240683"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is%20this%20possible%20to%20fix%20without%20API%20break%3F/near/169240683" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is.20this.20possible.20to.20fix.20without.20API.20break.3F.html#169240683">(Jun 28 2019 at 16:36)</a>:</h4>
<p>replacing with <code>mem::uninitialized</code>.... <em>shivers</em></p>



<a name="169240710"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is%20this%20possible%20to%20fix%20without%20API%20break%3F/near/169240710" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is.20this.20possible.20to.20fix.20without.20API.20break.3F.html#169240710">(Jun 28 2019 at 16:37)</a>:</h4>
<blockquote>
<p>Take <code>&amp;mut</code>? Is that even legal?</p>
</blockquote>
<p>what that crate does is considered to be legal, AFAIK. I have even proven it correct, but in a simplified model of Rust that does not have panics, so that proof only tells half the story.</p>



<a name="169240742"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is%20this%20possible%20to%20fix%20without%20API%20break%3F/near/169240742" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is.20this.20possible.20to.20fix.20without.20API.20break.3F.html#169240742">(Jun 28 2019 at 16:37)</a>:</h4>
<p>Good enough for me. Thanks a lot!</p>



<a name="169240865"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is%20this%20possible%20to%20fix%20without%20API%20break%3F/near/169240865" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is.20this.20possible.20to.20fix.20without.20API.20break.3F.html#169240865">(Jun 28 2019 at 16:38)</a>:</h4>
<p>notice that this turns panics into aborts</p>



<a name="169240883"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is%20this%20possible%20to%20fix%20without%20API%20break%3F/near/169240883" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is.20this.20possible.20to.20fix.20without.20API.20break.3F.html#169240883">(Jun 28 2019 at 16:39)</a>:</h4>
<p><a href="https://docs.rs/take_mut/0.2.2/take_mut/fn.take.html" target="_blank" title="https://docs.rs/take_mut/0.2.2/take_mut/fn.take.html">https://docs.rs/take_mut/0.2.2/take_mut/fn.take.html</a></p>



<a name="169240999"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is%20this%20possible%20to%20fix%20without%20API%20break%3F/near/169240999" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is.20this.20possible.20to.20fix.20without.20API.20break.3F.html#169240999">(Jun 28 2019 at 16:41)</a>:</h4>
<p>Oh, so the proof under a model without panics actually applies for the most part. Neat!</p>



<a name="169241731"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is%20this%20possible%20to%20fix%20without%20API%20break%3F/near/169241731" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> centril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is.20this.20possible.20to.20fix.20without.20API.20break.3F.html#169241731">(Jun 28 2019 at 16:50)</a>:</h4>
<p>This is one of the cases I'd like to have an effect/restriction system for "provably cannot panic"</p>



<a name="169242034"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is%20this%20possible%20to%20fix%20without%20API%20break%3F/near/169242034" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is.20this.20possible.20to.20fix.20without.20API.20break.3F.html#169242034">(Jun 28 2019 at 16:54)</a>:</h4>
<p>yeah that would be useful here. still seems too niche though to warrant the global cost of such an effect system.</p>



<a name="169242063"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is%20this%20possible%20to%20fix%20without%20API%20break%3F/near/169242063" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is.20this.20possible.20to.20fix.20without.20API.20break.3F.html#169242063">(Jun 28 2019 at 16:55)</a>:</h4>
<p><a href="https://github.com/viperproject/prusti-dev" target="_blank" title="https://github.com/viperproject/prusti-dev">https://github.com/viperproject/prusti-dev</a> can prove it for you</p>



<a name="169242074"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is%20this%20possible%20to%20fix%20without%20API%20break%3F/near/169242074" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is.20this.20possible.20to.20fix.20without.20API.20break.3F.html#169242074">(Jun 28 2019 at 16:55)</a>:</h4>
<p>that's safe-code-only though</p>



<a name="169242083"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is%20this%20possible%20to%20fix%20without%20API%20break%3F/near/169242083" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is.20this.20possible.20to.20fix.20without.20API.20break.3F.html#169242083">(Jun 28 2019 at 16:55)</a>:</h4>
<p>and a very limited but growing subset. but one day hopefully it can :)</p>



<a name="169242327"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is%20this%20possible%20to%20fix%20without%20API%20break%3F/near/169242327" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> centril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is.20this.20possible.20to.20fix.20without.20API.20break.3F.html#169242327">(Jun 28 2019 at 16:58)</a>:</h4>
<p>I think the global cost of an effect system gets amortized by the number of effects/restrictions (const, panic, async, ...)</p>



<a name="169242349"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is%20this%20possible%20to%20fix%20without%20API%20break%3F/near/169242349" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> centril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is.20this.20possible.20to.20fix.20without.20API.20break.3F.html#169242349">(Jun 28 2019 at 16:59)</a>:</h4>
<p>but... it's nice to know that something cannot panic purely as a sanity check rather than for soundness purposes</p>



<a name="169245504"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is%20this%20possible%20to%20fix%20without%20API%20break%3F/near/169245504" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is.20this.20possible.20to.20fix.20without.20API.20break.3F.html#169245504">(Jun 28 2019 at 17:34)</a>:</h4>
<p>There are so many weird effects, that I'm not sure we will ever get an effect system</p>



<a name="169245614"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is%20this%20possible%20to%20fix%20without%20API%20break%3F/near/169245614" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is.20this.20possible.20to.20fix.20without.20API.20break.3F.html#169245614">(Jun 28 2019 at 17:36)</a>:</h4>
<p>also the current situation where some effects are on by default while some are off is weird to handle generically</p>



<a name="169245669"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is%20this%20possible%20to%20fix%20without%20API%20break%3F/near/169245669" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Is.20this.20possible.20to.20fix.20without.20API.20break.3F.html#169245669">(Jun 28 2019 at 17:36)</a>:</h4>
<p>and we have compiler flags that turn effects on/off globally</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>